Skip to content

Commit 1e10f49

Browse files
committed
Fix critical permissions error.
Only logged-in users can administer. This was an interaction between paper managers/administrators and author-view capabilities. It may have been introduced recently, with the rights rewrite. Reported by Colin Dixon.
1 parent be7c271 commit 1e10f49

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

src/contact.php

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -666,9 +666,10 @@ private function rights($prow, $forceShow = null) {
666666
// check first whether administration is allowed
667667
if (@$ci->rights_version != $this->rights_version_) {
668668
$ci->allow_administer = false;
669-
if (!($prow->managerContactId
670-
&& $prow->managerContactId != $this->contactId
671-
&& $ci->conflict_type)
669+
if ($this->contactId > 0
670+
&& !($prow->managerContactId
671+
&& $prow->managerContactId != $this->contactId
672+
&& $ci->conflict_type)
672673
&& ($this->privChair
673674
|| $prow->managerContactId == $this->contactId))
674675
$ci->allow_administer = true;

0 commit comments

Comments
 (0)